* Frederic Buclin and Gervase Markham discovered that input passed to various fields throughout Bugzilla were not properly sanitized before being sent back to users (CVE-2006-5453).

* Frederic Buclin and Josh "timeless" Soref discovered a bug when viewing attachments in diff mode that allows users not of the "insidergroup" to read attachment descriptions. Additionally, it was discovered that the "deadline" field is visible to users who do not belong to the "timetrackinggroup" when bugs are exported to XML (CVE-2006-5454).

* Gavin Shelley reported that Bugzilla allows certain operations to be performed via HTTP GET and HTTP POST requests without verifying those requests properly (CVE-2006-5455).

* Max Kanat-Alexander discovered that input passed to showdependencygraph.cgi is not properly sanitized before being returned to users (CVE-2006-5453).

Impact=3D=3D=3D=3D=3D=3D

An attacker could inject scripts into the content loaded by a user'sbrowser in order to have those scripts executed in a user's browser inthe context of the site currently being viewed. This could includegaining access to privileged session information for the site beingviewed. Additionally, a user could forge an HTTP request in order tocreate, modify, or delete bugs within a Bugzilla instance. Lastly, anunauthorized user could view sensitive information about bugs or bugattachments.

This GLSA and any updates to it are available for viewing atthe Gentoo Security Website:

http://security.gentoo.org/glsa/glsa-200611-04.xml

Concerns?=3D=3D=3D=3D=3D=3D=3D=3D=3D

Security is a primary focus of Gentoo Linux and ensuring theconfidentiality and security of our users machines is of utmostimportance to us. Any security concerns should be addressed tosecurity@gentoo.org or alternatively, you may file a bug athttp://bugs.gentoo.org.